Privacy Policy

Privacy Policy - Last updated: 4 September 2026

1. Who we are

Spec + Source is the trading name of Charlotte Pritchard, a sole trader based in the United Kingdom. For UK data-protection law, Charlotte Pritchard trading as Spec + Source is the controller of the personal information described in this policy.

Contact details:

• Email: hello@specandsource.co.uk

• Business address: Bournemouth, Dorset, BH9 2TY

• Website: www.specandsource.co.uk

2. Scope of this policy

This policy explains how we collect and use personal information when you visit the website, contact us, subscribe to emails, purchase a digital product, or enquire about or receive consultancy services. It should be read with our Cookie Policy, Website Terms and Conditions and any separate proposal or service agreement.

3. Information we collect

Depending on how you interact with us, we may collect:

Identity and contact information, such as your name, business name, role, email address, telephone number and correspondence address.
Enquiry and project information that you choose to provide through forms, email, calls or consultations.
Order and transaction information, including products purchased, amount paid, date, billing details and order status.
Payment-related information supplied to a payment provider. We do not normally receive or store your complete payment-card number.
Marketing preferences, including whether you have subscribed, unsubscribed or interacted with an email.
Technical and usage information, such as IP address, device/browser type, referring pages, pages viewed and cookie identifiers, where permitted by your cookie choices.
Records of our communications, support requests, complaints and the action taken.

4. How we use information and our lawful bases

We use personal information only where we have a lawful basis. The principal purposes and bases are:

To respond to enquiries, prepare proposals and take requested steps before a contract: steps at your request before entering a contract and, where relevant, legitimate interests.
To process orders, deliver digital products, provide support and administer consultancy work: performance of a contract.
To issue invoices, maintain tax and accounting records, prevent fraud and meet regulatory requirements: legal obligation and legitimate interests.
To operate, secure, troubleshoot and improve the website and services: legitimate interests in running a safe and effective business, balanced against your rights.
To send optional marketing emails: your consent. You can unsubscribe at any time.
To use non-essential analytics or marketing cookies and similar technologies: your consent through the cookie banner, unless an applicable law permits a specific limited use without consent.

Where we rely on legitimate interests, you may ask for more information about the balancing assessment. We do not use your information for automated decision-making that produces legal or similarly significant effects.

5. Where information comes from

Most information comes directly from you. We may also receive limited information from Wix and connected services, payment providers, analytics or advertising platforms, professional advisers, publicly available business sources, or a person who introduces you to us.

6. Who we share information with

We share only what is reasonably necessary with trusted providers and recipients, which may include:

Wix, which hosts the website and may provide store, form, email, order and delivery functions.
Payment providers such as PayPal and any other provider shown at checkout.
Google, if Google Analytics or another Google service is enabled and you consent where required.
Pinterest, if the Pinterest Tag or related advertising tools are enabled and you consent where required.
Email, cloud-storage, bookkeeping, accounting, legal, insurance, IT and security providers.
Authorities, regulators, courts, insurers or professional advisers where disclosure is required or reasonably necessary to establish, exercise or defend legal rights.

Some providers act as independent controllers for their own purposes. Their privacy information will apply to their processing.

7. International transfers

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we take reasonable steps to use an adequacy regulation, approved contractual protections such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. You may contact us for further information about relevant safeguards.

8. How long we keep information

We keep information only for as long as reasonably necessary for the purpose collected, including legal, accounting and dispute requirements.

As a general guide:

Unsuccessful or inactive enquiries: normally up to 24 months after the last meaningful contact.
Customer, order, contract, invoice and accounting records: normally up to six years after the relevant transaction or relationship ends, or longer where legally required.
Marketing records: until you unsubscribe or withdraw consent, with periodic review of inactive contacts.
Support and complaint records: normally up to six years where needed to handle or defend a claim.
Cookie information: for the periods displayed in the live Cookie Settings panel or cookie scan.

We may retain a minimal suppression record after an unsubscribe so that we can respect your choice.

9. Security

We use proportionate organisational and technical measures designed to protect personal information. No online transmission or storage system is completely secure, so we cannot guarantee absolute security.

10. Your rights

Depending on the circumstances, UK data-protection law may give you rights to access your information; correct inaccurate information; request erasure; restrict processing; object to processing; receive certain information in a portable format; and withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully.

Your right to object: You have the right to object to processing based on legitimate interests and to direct marketing. We will stop direct marketing when you object.

To exercise a right, email hello@specandsource.co.uk. We may need to verify your identity. There is normally no fee, although the law allows a reasonable fee or refusal in limited circumstances.

11. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, at ico.org.uk or by using the contact details published on its website.

12. Children

The website and services are intended for adults and businesses and are not directed to children. Please do not provide personal information about a child unless it is genuinely necessary and you are authorised to do so.

13. External links

The website may link to third-party sites or services. We are not responsible for their privacy practices. Please read their privacy information before supplying personal data.

14. Changes to this policy

We may update this policy when our business, service providers or legal obligations change. The current version and last-updated date will be published on this page. We will give additional notice where a change materially affects how we use personal information.